Joakim
500224b5de
- Implemented complete Podman infrastructure role following rick-infra patterns - Minimal installation approach: only install podman, trust Arch dependency management - Configured with crun runtime for optimal performance and security - Security-focused: HTTPS-only registries, rootless containers, systemd hardening - Registry support: docker.io, quay.io, ghcr.io with secure configurations - Ready for service-specific users with isolated container environments - Quadlet support for native systemd container management - Container-to-host networking via bridge networks with host gateway access - Foundation for future containerized services (Authentik, Nextcloud) - Maintains rick-infra philosophy: infrastructure provides foundation, apps manage specifics
79 lines
2.0 KiB
YAML
79 lines
2.0 KiB
YAML
---
|
|
# Podman Infrastructure Role - Simplified Tasks
|
|
|
|
- name: Update package cache
|
|
pacman:
|
|
update_cache: yes
|
|
|
|
- name: Install crun as OCI runtime (faster than runc)
|
|
pacman:
|
|
name: crun
|
|
state: present
|
|
|
|
- name: Install Podman container runtime
|
|
pacman:
|
|
name: podman
|
|
state: present
|
|
|
|
- name: Verify podman installation
|
|
command: podman --version
|
|
register: podman_version_check
|
|
changed_when: false
|
|
|
|
- name: Create global containers configuration directory
|
|
file:
|
|
path: /etc/containers
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
- name: Configure global container registries
|
|
template:
|
|
src: registries.conf.j2
|
|
dest: /etc/containers/registries.conf
|
|
mode: '0644'
|
|
backup: yes
|
|
notify: restart podman
|
|
|
|
- name: Configure global podman settings
|
|
template:
|
|
src: containers.conf.j2
|
|
dest: /etc/containers/containers.conf
|
|
mode: '0644'
|
|
backup: yes
|
|
notify: restart podman
|
|
|
|
- name: Enable podman system service (if enabled)
|
|
systemd:
|
|
name: podman
|
|
enabled: "{{ podman_service_enabled }}"
|
|
state: "{{ podman_service_state }}"
|
|
daemon_reload: yes
|
|
when: podman_service_enabled
|
|
|
|
- name: Test podman functionality
|
|
command: podman info --format json
|
|
register: podman_info_result
|
|
changed_when: false
|
|
|
|
- name: Verify rootless podman configuration
|
|
command: podman system info
|
|
register: podman_system_info
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Display Podman infrastructure status
|
|
debug:
|
|
msg: |
|
|
✅ Podman container infrastructure ready!
|
|
|
|
🐳 Version: {{ podman_version_check.stdout.split()[2] | default('unknown') }}
|
|
🔒 Security: Rootless container runtime enabled
|
|
📦 Registries: {{ podman_registries | join(', ') }}
|
|
🏗️ Storage: {{ 'overlay' if 'overlay' in podman_system_info.stdout else 'system default' }}
|
|
|
|
🚀 Ready for containerized applications!
|
|
|
|
📋 Next Steps:
|
|
- Applications should create service-specific users
|
|
- Each user gets isolated container environment
|
|
- Services deploy quadlet files for systemd integration |